Not on the government side, but on the implementation side it has at a minimum caused organizations to shift from "better keep this data just in case" to "hey, can we maybe not have all this data around I don't want to be responsible for it."

These are great questions. I suggest two approaches.

First, if you consider the sample size and timeline large enough, you can weigh what the goals were to what has actually happened (be sure to include the societal costs of the legislation in your calculation).

Second, you can look at the success or failure of previous attempts (e.g. data protection directive) and the reasons for success or failure. Are we repeating history, for better or worse, concerning government oversight of the internet and enforcement? Did we improve on the successes by adding more (larger scope, bigger fines, more legislation, etc) or did we exacerbate the failures?

While the questions are subjective and therefore not amenable to an objective large-scale determination, they help me arrive at a conclusion personally.

At the very least this is providing valuable information for consumers, regulators, and legislators on the scale of the problem.

One of the big issues pre-GDPR is that companies weren't always forthcoming about their data breaches, so the scale of the issue was unknown.

This meant that people looking at either solutions or at necessary regulations/legislation were acting in the dark.

How will we know is perhaps a better framing? I mean, the law has not even been active for a year. We know basically nothing yet, any quantifiable effects have not had time to happen yet.